Your Backup Is Also A Target

Synology has told customers to update their storage devices immediately because ransomware is encrypting the ones running out-of-date software. The flaw being used was repaired long before the attacks started. For most small offices that box is where the backups live, which makes it the one device worth logging into this week.

Synology makes the small storage boxes that sit in a cupboard in a great many small offices, holding shared files and often the backups. On November 3 it was reported that the company has told customers to update them immediately, because ransomware is encrypting the ones still running old software. Synology repaired the flaw two years ago, in November 2024. That is the whole story, and it is not really about Synology. Our interest: we sell and maintain backup systems, so an article telling you to look at your backup box can end in an invoice from us. We will not tell you which brand to buy — the problem here is old software rather than a bad product, and old software comes in every brand. The technical part — you can skip this box Synology's own advisory is Synology-SA-24:20 , titled "DSM (PWN2OWN 2024)," published 5 November 2024 and last updated 28 March 2025. We read it. It is rated Critical and marked Resolved, and it covers three catalogue numbers — a catalogue number being the industry's case number for one specific flaw. The most serious, CVE-2024-10441, scores 9.8 out of 10 and in the advisory's words "allows remote attackers to execute arbitrary code via unspecified vectors," with no login required. The other two let an attacker read or write a limited set of files. The fixed releases, in the advisory's own words and with the direction exactly as it states it: DSM 7.2.2 — "Upgrade to 7.2.2-72806-1 or above." DSM 7.2.1 — "Upgrade to 7.2.1-69057-6 or above." DSM 7.2 — "Upgrade to 7.2-64570-4 or above." DSM 7.1 — "Upgrade to 7.1.1-42962-7 or above." DSM 6.2 — "Upgrade to 6.2.4-25556-8 or above." In every case the number listed is the lowest safe version, and anything below it in that family is affected. DSM is DiskStation Manager, the software these devices run. Two things the advisory does not say. It does not mention exploitation in the wild, and it never mentions C3RB3R. Those come from a separate Synology statement, reported on 3 November 2026 by Ravie Lakshmanan at The Hacker News, which quotes Synology: "Synology strongly urges all users running vulnerable versions to update DSM immediately to protect their systems," and "Synology also recommends enabling automatic updates to keep DSM up to date at all times." That report names the ransomware C3RB3R, says it encrypts files and adds the extension .L0CK3D, and says it leaves a ransom note called read-me3.txt in every folder it encrypts. It also says Synology has not disclosed which flaw is being exploited — so the link between these attacks and the advisory above is Synology's own pointer rather than a confirmed identification, and we are not asserting it is the same flaw. One correction worth recording. That report's opening sentence dates the repair to December 2024 while its own body links the November 2024 advisory. The advisory is dated 5 November 2024, so the body is right and the opening sentence is wrong. We could not reach the separate Synology statement directly, so every quotation from Synology about the current attacks is that reporter's reading of it. No figures have been published for how many devices have been hit, and none for ransom amounts. Nothing in any of it says how the attackers reach these devices; the advice below about outside access is ours, not theirs. What that actually means The box in the cupboard is a computer. It runs its own software, has its own login, and needs its own updates. Most people treat it as furniture because it never asks for anything. Ransomware scrambles your files and asks for money to unscramble them. This one works through whatever it can reach on the device and leaves a note behind in each folder. The part that is actually good news Synology's own advice is to switch on automatic updates, which means the setting exists. This is one of the few security problems you can close permanently in a single visit. And if your device is current, you are already finished with the news part of this article. The caveat, which is a check rather than a fear A current device is not the same thing as a working backup. Updating the software protects the box; it does not tell you whether the files on it can be recovered. So the check is a restore, not a report. A report says a job ran. A restored file says the result is usable. Only one of those is evidence. What to do this week Log in and install whatever update is waiting, then turn on automatic updates. This is the whole of the urgent part. Ask whether the device can be reached from outside the office. For most small offices it has no reason to be. That is our advice, not the reporting's. Make sure one copy of your files lives somewhere the office network cannot write to. Ransomware reaches what the network reaches. A copy it cannot touch is the difference between a bad afternoon and a bad quarter. Restore one file and open it. Pick something unimportant. If you cannot, you have found this out on a quiet Thursday rather than on the worst day of your year. If we manage your backups, ask us where the copy lives that the office cannot reach. If that takes us more than a minute, it is worth knowing about us.